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© Reconfigurable air bag firing circuit 

© An air bag firing circuit (10) comprises a firing 
path which includes in series a safing sensor (16), a 
squib (20), and a FET (22) operated under micropro- 
cessor control (24) in response to the output of an 
electronic crash sensor (26). A power supply (28) 
maintains a known voltage (Vc) across the firing path 
(12) sufficient to explode the squib (20) upon si- 
multaneous "closure" of both the safing sensor (16) 
and the FET (22) operated by the microprocessor 
(24) in response to crash sensor output (26). Nor- 
mally, upon detection of a failure in the electronic 
crash sensor (26), its supporting electronics, or the 
FET (22) actuated in response thereto, the micropro- 
cessor (24) reconfigures the firing threshold of the 



safing sensor (16), as by applying a current to its 
integral test coil (38) to increasingly bias the sen- 
sor's inertia! mass away from its switch contacts 
(14). However, if a failure of the safing sensor (16) is 
detected, reconfiguration of its threshold is inhibited 
notwithstanding the failure of other circuit compo- 
nents to prevent inadvertent deployment of the air 
bag. Once the safing sensor (16) is reconfigured, the 
microprocessor (24) turns on another FET (46) to 
pull one side of the squib to ground, thereby remov- 
ing the inoperable FET from the firing path and 
ensuring continued protection of the vehicle pas- 
sengers until the sensor is serviced or replaced. 
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BACKGROUND OF THE INVENTION 

The instant invention relates to control circuits 
for vehicle passenger safety restraints, such as air 
bags, comprising a firing path which includes two 
acceleration sensors whose acceleration-responsive 
switches are connected in series with an explosive 
squib. 

Known air bag passenger restraint systems 
employ a control circuit wherein a power supply 
applies a voltage across a firing path which in- 
cludes in series an explosive squib and two accel- 
eration sensors having normally-open acceleration- 
responsive switches therein. The switch of each 
sensor is shunted by a resistor having a nominal 
resistance substantially greater than the internal 
resistance of the squib. Thus, a small current nomi- 
nally flows through the firing path while the switch- 
es of the sensors remain in their normally-open 
positions. The closure of the sensors's switches in 
response to a collision or marked vehicle decelera- 
tion causes a significant rise in the current flowing 
through the squib, thereby "firing" the squib and 
triggering deployment of the air bag. See, e.g., U. 
S. Patent No. 4,695,075, issued September 22, 
1987 to Kamiji et al. 

Under the prior art, if the switch of either sen- 
sor fails in its closed position, or with a propensity 
to close, the prior art teaches the disabling of the 
entire control circuit to prevent the unintentional or 
premature triggering of the passenger restraint, 
once again placing the passengers at risk. See, 
e.g., U. S. Patent No. 3,889,232, issued June 10, 
1975 to Bell, wherein the control circuit shuts down 
when one sensor closes without the corresponding 
closing of the other sensor. 

Alternatively, in our U. S. Patent No. 4,958,851 
issued September 25, 1990, we teach a recon- 
figurable air bag firing circuit whose firing path 
comprises two acceleration sensors connected in 
series with an explosive squib. The firing circuit 
further includes means for functionally removing 
the malfunctioning sensor from the firing path by 
closing or shunting the malfunctioning sensor, 
thereby providing continued protection of the ve- 
hicle passengers under the control of the remain- 
ing, still-operable sensor. 

The instant invention is directed to an im- 
proved reconfigurable air bag firing circuit and an 
improved method of operating same. 

SUMMARY OF THE INVENTION 

It is an object of the instant invention to provide 
an improved control circuit for vehicle passenger 
safety restraints which includes two sensors whose 
acceleration-responsive switches are connected in 
series in the firing path thereof, and featuring con- 



tinuing circuit viability notwithstanding the malfunc- 
tion, or "failure," of the crash-discriminating sensor. 

A further object of the instant invention is to 
provide an improved method of operating such a 

5 control circuit to provide increased reliability not- 
withstanding a single-point failure therein. 

The improved control circuit for a vehicle pas- 
senger safety restraint of the instant invention com- 
prises a low-threshold acceleration sensor, or 

10 "safing sensor," whose acceleration-responsive 
switch is connected in series with an explosive 
squib and a FET, with the FET closing under 
microprocessor control in response to the output of 
an electronic sensor employing a relatively-higher 

75 threshold. Upon the detection of a failure of the 
crash-discriminating electronic acceleration sensor 
and/or its supporting electronics, and after con- 
firmation of continuing safing sensor functionality, 
the circuit reconfigures the firing circuit by raising 

20 the acceleration threshold of the safing sensor and 
then, after a suitable delay, removing the FET from 
the firing path by pulling down the side of the squib 
opposite the safing sensor to ground. In the pre- 
ferred embodiment of the invention, the safing sen- 

25 sor is tested, and its threshold alternatively raised, 
by passing a current from a constant current 
source through a test coil integral to the sensor, as 
controlled by an application specific integrated cir- 
cuit. 

30 

BRIEF DESCRIPTION OF THE DRAWING 

The accompanying drawing is a schematic 
block diagram of an exemplary air bag firing circuit 
35 according to the instant invention. 

DETAILED DESCRIPTION OF THE PREFERRED 
EMBODIMENT OF THE INVENTION 

40 Referring to the drawing, an exemplary air bag 
firing circuit 10 according to the instant invention 
comprises a firing path 12 which includes, in se- 
ries, the normally-open, relatively-low-threshold 
acceleration-responsive switch 14 of an accelera- 

45 tion sensor (hereinafter "safing sensor 16"); and 
parallel firing path legs 18a and 18b each having in 
series an explosive squib 20 for triggering deploy- 
ment of a driver's-side and a passenger's-side air 
bag, respectively (both not shown), and a FET 

so ("firing FET 22") for pulling down the side of each 
squib 20 opposite the safing sensor 16 to ground 
when operated by a microprocessor 24. The micro- 
processor 24 is itself responsive to the output of an 
electronic crash sensor integrated within an Ap- 

55 plication Specific Integrated Circuit ("Sensor ASIC 
26"), as more fully described below. 

A power supply 28 applies a known supply 
voltage V s across the firing path 12 sufficient to 
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explode each squib 20 upon the simultaneous clo- 
sure of the sating sensor's switch 14 and the firing 
FET 22 connected to the squib 20. The power 
supply 28 includes a capacitor 30 and charge 
pump 32 to maintain the applied voltage V s if the 
battery 34 connected thereto malfunctions or is 
otherwise isolated therefrom during a vehicle colli- 
sion. 

The safing sensor 16 is itself schematically 
represented in the drawing as a normally-open 
acceleration-responsive switch 14 which may be 
closed irrespective of acceleration upon the pas- 
sage of a current from a constant current source 36 
through an integral test coil 38. And, by passing 
the current through the test coil 38 in the opposite 
direction, the nominal bias on the acceleration- 
responsive switch 14 may be increased, whereby a 
higher level of sensed acceleration is required to 
close the switch 14 and fire the squibs 20. A 
constructed embodiment of the safing sensor 1 6 is 
taught in in. S. Patent No. 4,827,091 issued May 2, 
1989, to Behr, the teachings of which are hereby 
incorporated herein by reference. 

Similarly, a constructed embodiment of the 
crash sensor integrated into the Sensor ASIC 26 is 
disclosed in our co-pending in. S. Patent Applica- 
tion Serial No. 07/413,318 filed September 27, 
1989, and entitled "Self-Calibrating Accelero- 
meter," which teaching is also hereby incorporated 
herein by reference. Simply stated, the electronic 
sensor within the Sensor ASIC 26 provides an 
analog output proportional to vehicle acceleration, 
as through the incorporation of a piezoresistive 
element in the support beam of the sensor's micro- 
machined cantilevered inertia) mass. After analog- 
to-digital conversion of the electronic sensor's out- 
put within the Sensor ASIC 26, the resulting accel- 
eration data is communicated to the microproces- 
sor 24 via a Serial Peripheral Interface ("SPI 40"), 
whereupon the microprocessor 24 determines 
whether a threshold acceleration has been exceed- 
ed, thereby indicating a crash condition. If a crash 
condition is indicated, the microprocessor 24 turns 
on the firing FETs 22 to pull down the side of each 
squib 20 opposite the safing sensor 16 to ground. 

The normally-open switch 1 4 of the safing sen- 
sor 16 and each firing FET 22 are shunted by a 
resistor 42 of like nominal resistance. Preferably, 
the nominal resistance of the shunting resistors 42 
is several orders of magnitude larger than the 
nominal internal resistance of each of the squibs 
20. In normal operation, the shunting resistors 42 
maintain a relatively-low current flow through the 
firing path 12 and, hence, through the squibs 20 
thereof. Upon the simultaneous closure of the saf- 
ing sensor 16 and the firing FETs 22 in response to 
an acceleration exceeding the respective thresh- 
olds of the safing sensor 16 and the electronic 



crash sensor within the ASIC 26 (as determined by 
the microprocessor 24), the shunting resistors 42 
are shorted and the current flowing through each 
squib 20 increases to a value above the firing 

5 threshold thereof to explode same and trigger de- 
ployment of each air bag. 

The instant circuit 10 further comprises an Ap- 
plication Specific Integrated Circuit ("Diagnostic 
ASIC 44") for diagnosing a failure of the Sensor 

jo ASIC 26 to properly respond to acceleration, as 
through interpretation of Sensor ASIC data commu- 
nicated thereto via the SPI 40. An exemplary meth- 
od for testing the integrity of the firing path of an 
air bag firing circuit is taught in U. S. Patent No. 

75 4,851,705 issued July 25, 1989, to Musser et al, 
the teachings of which are hereby incorporated 
herein by reference. 

An additional FET ("reconfiguration FET 46") is 
connected to the firing path 12 at points on each 

20 leg 18a and 18b between the squib 20 and the 
firing FET 22 thereon via a diode 48, with the 
reconfiguration FET 46 being controlled by the 
Sensor ASIC 26. The reconfiguration FET 46 allows 
the Sensor ASIC 26 to pull the side of each squib 

25 20 opposite the safing sensor 16 to ground when 
the Diagnostic ASIC 44 detects a failure of the 
Sensor ASIC's integral electronic crash sensor or 
its supporting electronics, including failures of the 
microprocessor 24 or the FETs 22 controlled by 

30 the microprocessor 24. 

Under the instant invention, reconfiguration of 
the circuit's firing path 12 is controlled by the two 
ASICs 26 and 44, the constant current source 36, 
and the microprocessor 24, as follows: in the cir- 

35 cuit's normal mode of operation, the microproces- 
sor 24 initiates firing-path reconfiguration through 
the use of a watchdog timer in the Diagnostic ASIC 
44. Specifically, the microprocessor 24 periodically 
resets the timer by sending reconfiguration pulses 

40 50 to the Diagnostic ASIC 44. If the microprocessor 
24 detects a failure of the Sensor ASIC 26, e.g., the 
failure of its electronic crash sensor to properly 
respond to acceleration, or excessive electromag- 
netic interference ("EMI"), the microprocessor 24 

45 stops transmitting reconfiguration pulses 50 to the 
Diagnostic ASIC 44, and the timer runs out to 
trigger reconfiguration. Similarly, the microproces- 
sor 24 will request reconfiguration of the circuit's 
firing path 12 upon detecting a failure of any of the 

50 firing FETs 22 or the reconfiguration FET 46. A 
suitable period for the watchdog timer is believed 
to be about 250 msec. 

The Diagnostic ASIC 44 also monitors the 
microprocessor 24 through a deadman timer. In 

55 normal operation, the microprocessor 24 periodi- 
cally sends a deadman signal 52 to the Diagnostic 
ASIC 44 to confirm its continuing operability. Upon 
cessation of the deadman signal 52 or other detec- 
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tion of a failure of the microprocessor 24 over the 
SPI 40, the Diagnostic ASIC 44 sends a reset 
signal 54 to the microprocessor 24 in an attempt to 
return the circuit 10 to full functionality. Should the 
microprocessor 24 fail to respond to a reset, the 
above-described watchdog timer will run out, again 
causing the Diagnostic ASIC 44 to initiate the re- 
configuration sequence, as described more fully 
below. Thus, the use of the watchdog timer permits 
the Diagnostic ASIC 44 to reconfigure the firing 
path 12 notwithstanding the failure of the micropro- 
cessor 24, thereby enhancing the reliability of the 
instant circuit 10. 

The Diagnostic ASIC 44 may also conduct pe- 
riodic dynamic testing of the safing sensor 16 
under microprocessor control by sending appro- 
priate signals 62, 64, and 66 through the PHASE, 
lo, and h terminals of the constant current source 
36, which in turn directs a current 60 in a first 
direction through the sensor*s test coil 38 while 
monitoring the voltage at point 58 on the firing path 
12. 

Once triggered, the reconfiguration sequence 
for the instant circuit 10 is as follows: the Diagnos- 
tic ASIC 44 first determines whether the safing 
sensor 16 has been shorted to ground by monitor- 
ing the voltage at a point 58 on the firing path 12 
between the safing sensor 16 and both squibs 20. 
If continuing safing sensor functionality (and firing 
path integrity) is confirmed, the Diagnostic ASIC 44 
will send signals 62, 64, and 66 through PHASE, l 0 
and h terminals of the constant current source 36, 
respectively, whereby the current 60 is directed in 
a second direction through the sensor's test coil 38 
to increase its threshold by increasingly biasing its 
switch 14 in the open position. When the current 
source 36 is turned on, the current source 36 also 
generates current sense pulses 68 which are 
counted by the Sensor ASIC 26. After a suitable 
number of pulses 68 are counted by the Sensor 
ASIC 26, thereby representing a reasonable time 
delay to permit the reconfigured safing sensor 16 
to achieve a steady-state heightened threshold, the 
Sensor ASIC 26 turns on the reconfiguration FET 
46 to pull down the sides of the squibs 20 opposite 
the safing sensor 16 to ground. The firing path 12 
of the instant circuit 10 is thus reconfigured, with 
the heightened-threshold safing sensor 16 there- 
after operating as the circuit's crash-discriminating 
sensor. 

Preferably, the Sensor ASIC 26 counts the 
current sense pulses 68 only when the PHASE 
input to the Sensor ASIC 26 is high, thereby pre- 
venting an inadvertent increase in the safing sen- 
sor's threshold upon malfunction of the current 
source 36. 

If the monitored voltage at point 58 on the 
firing path 12 indicates a shorted safing sensor 16, 



the Diagnostic ASIC 44 terminates the reconfigura- 
tion sequence, since it otherwise might result in 
inadvertent deployment of the air bags if the recon- 
figuration FET 46 would thereafter be turned on. 

5 Under the instant invention, there is no need to 

reconfigure the system upon single-point failure of 
either the Diagnostic ASIC 44 or the current source 
36, as the instant circuit 10 will continue to operate 
in its normal mode through continued operation of 

w the Sensor ASIC 26 and the microprocessor 24. 
And, as noted above, in the event of a failure of the 
Sensor ASIC 26, reconfiguration may be effected 
by the Diagnostic ASIC 44 and the microprocessor 
24. Similarly, in the event of a failure of the micro- 

75 processor 24, reconfiguration remains possible by 
virtue of continued operation of the Diagnostic 
ASIC 44, the current source 36, and the Sensor 
ASIC 26. 

While the preferred embodiment of the inven- 

20 tion has been disclosed, it should be appreciated 
that the invention is susceptible of modification 
without departing from the spirit of the invention or 
the scope of the subjoined claims. For example, 
under the instant invention, the Sensor and Di- 

25 agnostic ASICs 26 and 44 may be repackaged so 
as to place all reconfiguration control in a separate 
Reconfiguration ASIC which is therefore wholly in- 
dependent from the components providing diag- 
nostic capability. Such a reconfiguration ASIC 

30 would preferably incorporate V s , current sense, and 
voltage monitoring inputs; PHASE, l 0 , h, reconfig- 
uration FET control, and reconfiguration pulse out- 
puts; and SPI communication with other circuit 
components regarding electronic sensor output, 

35 test signal requests, and other circuit component 
status communication. 

Claims 

40 1. In a control circuit for a vehicle passenger 
safety restraint, said control circuit having: 

a firing path which includes, in series, 
current-responsive trigger means for actuating 
said restraint; and a first and a second 

45 normally-open switch means, said first and 
second switch means closing in response to 
an acceleration input exceeding a first and 
second threshold, respectively, said second 
threshold being nominally greater than said 

so first threshold; 

means for applying a voltage across said 
firing path; 

first failure detecting means for detecting a 
failure of said second switch means; and 
55 shunt means responsive to said first failure 

detecting means for shunting said second 
switch means upon detection of a failure of 
said second switch means; and 
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threshold-adjusting means responsive to 
said first failure detecting means, said 
threshold-adjusting means being operative to 
increase said first threshold above its nominal 
value, 5 

the improvement comprising: 

second failure-detecting means for detect- 
ing a failure of said first switch means, and 

said threshold-adjusting means being re- 
sponsive to said second failure-detecting to w 
inhibit operation of said threshold-adjusting 
means upon detecting a failure of said first 
switch means. 

2. The control circuit of claim 1 wherein said 75 
threshold-adjusting means includes means for 
increasingly biasing said first switch means in 

said normally-open position. 

3. A control circuit for a vehicle passenger re- 20 
straint comprising: 

a firing path including in series: 

a first, normally-open, acceleration-respon- 
sive switch which closes in response to an 
acceleration input exceeding a first threshold, 25 
said first switch being shunted by a first shunt- 
ing resistor; 

trigger means for actuating said restraint, 
said trigger means having internal electrical 
resistance substantially less than said resis- 30 
tance of said first shunting resistor; and 

a second and third normally-open, 
electrically-operated switch, said second 
switch being shunted by a second shunting 
resistor having a resistance substantially great- 35 
er than the internal resistance of said trigger 
means; 

means for applying a voltage across said firing 
path; 

an electronic sensor for sensing an accel- 40 
eration exceeding a second threshold, said 
second threshold being nominally greater than 
said first threshold; 

a microprocessor responsive to said elec- 
tronic sensor for operating said controlling said 45 
second switch, said microprocessor closing 
said second switch when said electronic sen- 
sor senses an acceleration exceeding said 
second threshold; 

failure-detecting means for detecting a fail- 50 
ure of first switch, said electronic sensor, said 
microprocessor, or said second switch; 

first means responsive to said failure-de- 
tecting means for increasingly biasing said first 
switch in said normally-open position; and 55 

second means responsive to said failure- 
detecting means for operating said third 
switch. 



4. The circuit of claim 3 wherein said first means 
responsive to said failure-detecting means in- 
cludes 

a constant current source; and 
a coil connected to said constant current 
source. 

5. A method of operating the circuit of claim 3, 
said operating method including the steps of: 

detecting a failure of at least one of said 
group consisting of said electronic sensor, said 
microprocessor, and said second switch; 

confirming the continued operability of 
said first sensor by not detecting a failure 
thereof with said failure-detecting means; 

operating said first means responsive to 
said failure-detecting means to increasingly 
bias said first switch in said normally-open 
position after confirming the continued oper- 
ability of said first sensor; and 

operating said second means responsive 
to said failure-detecting means to close said 
third switch after said first switch is increas- 
ingly biased in said normally-open position. 
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